The following provides an example procedure to configure customize claim rules for all AD users/groups in DDAN_groups. Based on this configuration, you can further limit the single sign-on permission by configuring Access Control Policy settings and create SAML groups in DDAN.

1. Go to ADFS > Relying Party Trusts and select the created application for DDAN.

2. Right-click the application and select Edit Claim Issuance Policy....

   The Edit Claim Issuance screen appears.

3. On the Issuance Transform Rules tab, select Add Rule...

4. Complete settings on each tab of the Add Transform Claim Rule Wizard screen:

   1. On the Choose Rule Type tab, select Send LDAP Attributes as Claims from the Claim rule template drop-down list, and click Next.
   2. On the Configure Claim Rule tab, specify a claim rule name in the Claim rule name text box (for example, ‘Name ID’) and select Active Directory from the Attribute store drop-down list.
   3. Select the attribute and specify Name ID as the outgoing claim type for the attribute.

   4. Click OK.

      LDAP attribute

      Claim Rule Name	LDAP Attribute	Outgoing Claim Type
      <user-defined rule name>	User-Principal-Name	Name ID

   5. Create customize claim rules. Complete the following steps:

      1. Click Add Rule....

         The Add Transform Claim Rule Wizard screen appears.

      2. On the Choose Rule Type tab, select Send Claims Using a Custom Rule from the Claim rule template drop-down list, and click Next.

         The Configure Claim Rule tab appears.

      3. On the Configure Claim Rule tab, specify a claim rule name in the Claim rule name text box, and type the custom claims displayed in the following table.

         Custom Rules

         Claim Rule Name	Custom Rule
         <user-defined rule name> e.g. nameDN	c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", Issuer == "AD AUTHORITY"]=> add(store = "Active Directory", types = ("nameDN"), query = ";distinguishedName;{0}", param = c.Value);
         <user-defined rule name> e.g. DDAN_groups	c1:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", Issuer == "AD AUTHORITY"]&& c2:[Type == "nameDN"]=> issue(store = "Active Directory", types = ("DDAN_groups"), query = "(member:1.2.840.113556.1.4.1941:={1});samaccountname;{0}", param = c1.Value, param = c2.Value);

      4. Click Apply and then click OK. Repeat to set all the claim rules.

      All used schema inherited in ADFS

      • Name ID: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier
      • Username Attribute: http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname

      References

      • Microsoft Documentation: Distinguished Names
      • ldapwiki page: LDAP_MATCHING_RULE_IN_CHAIN
      • Microsoft TechNet article: Understanding Claim Rule Language in AD FS 2.0 & Higher
      • Microsoft Documentation: Search Filter Syntax